Reduce scopes granted to GITHUB_TOKEN in GitHub Actions workflows (#265)

As part of security-hardening our GHA workflows, this reduces the
permissions granted to the automatically set `GITHUB_TOKEN` env var
in GitHub Actions workflows to no more than what is required by that
workflow.

See:
https://docs.github.com/en/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions
https://docs.github.com/en/actions/security-for-github-actions/security-guides/automatic-token-authentication

GUS-W-18053749.

Author: edmorley

.github/workflows/prepare-release.yml

@@ -13,6 +13,9 @@ on:
           - minor
           - patch
 
+# Disable all GITHUB_TOKEN permissions, since the GitHub App token is used instead.
+permissions: {}
+
 jobs:
   prepare-release:
     uses: heroku/languages-github-actions/.github/workflows/_buildpacks-prepare-release.yml@latest

.github/workflows/release.yml

@@ -8,6 +8,9 @@ on:
         type: boolean
         default: false
 
+# Disable all GITHUB_TOKEN permissions, since the GitHub App token is used instead.
+permissions: {}
+
 jobs:
   release:
     name: Release